- Splunk Answers
- :
- Using Splunk
- :
- Reporting
- :
- Search with a count of events in a time window by ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Search with a count of events in a time window by host
Hello,
I am new with Splunk and I have to do some searches to prevent attacks and things like that. I have around 45 servers (Linux or Windows) which send logs to my Splunk server.
I need your help to have an example of a search that I can't do with my current knowledge.
I need to search every authentifications fails. If there is more than 5 fails in less than 5 minutes in the same host then I send an email or an alert to Nagios. Is it possible to do that, and if yes, how ?
Thank you for your help !
(Sorry if there is some english mistakes)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use Splunk For Nagios to Schedule Saved Searches in Splunk to send alerts to Nagios. I wrote the app for that exact purpose, and it also allows you to search Nagios alerts and notifications and trend problems over time. Over 40 field extractions are included, as well as 6 Saved Searches, and an Advanced Dashboard featuring recent Warning and Critical Alerts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe something like this for a search:
(your search for fails) | bucket _time span=5m | stats count by user,host,_time | search count>4
After that save the search and set it up as an alert.
Hope this helps
Travis.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you just want to setup a search to run every 5 minutes and report on the previous 5 minutes to alert of any failures greater than 5. How about this: (your search for fails) earliest=-5min | stats count by user,host,_time | search count>4
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is not far, but this solution returns all the events in 5min windows. I need to see only the events in the past 5min. In example if I do that :
(search) | bucket _time span=5m | stats count by user,host,_time | search count>4 | sort -_time | head 1
I have one event but from yesterday at 22h PM, so if I schedule this search every 5min, Nagios will receive plenty alerts for this event.
I need to see if there is an event in the past 5min or not. If there is, I create an alert, if not everything is okay.
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
